BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-21

Assigner: Naver Corporation

Description

Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-21

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62585

EUVD

EUVD-2025-34717

Affected Vendors & Products

Vendor	Product	Version / Range
navercorp	whale	to 4.33.325.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-358	The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Attack-Flow Graph

Executive Summary

This vulnerability in Whale browser versions before 4.33.325.17 allows an attacker to bypass the Content Security Policy (CSP) by exploiting a specific scheme in a dual-tab environment. Essentially, it means that the security restrictions intended to control which resources can be loaded or executed by the browser can be circumvented under certain conditions involving multiple tabs.

Impact Analysis

By bypassing the Content Security Policy, an attacker could potentially execute unauthorized scripts or load malicious resources in the browser, which may lead to security risks such as data theft, session hijacking, or other malicious activities that compromise user security and privacy.

Hi! I’m here to help you understand CVE-2025-62585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70